Guide · Governance, policy and return on investment
AI governance for small and mid-sized organisations: a simple framework
AI governance is how an organisation decides which AI tools people may use, for what, with which data, and who answers for the results. For a small organisation that uses AI rather than builds it, that means a few written rules, an owner for each, a way to report problems and a date to review them.
By Andrew Ward, Founder of ScorchsoftChecked 13 minute read
In short
- Start by finding out what people already use, without blame. Governance that ignores current use governs nothing.
- Write one page first: approved tools, what data goes where, who owns what, how to report a problem, and a review date.
- Give every rule an owner and put the rules that must never fail into permissions or process checks, not only into instructions.
- The UK has no AI Act. Existing law applies (data protection, equality, employment) through the regulators you already answer to.
- ISO/IEC 42001 and the NIST frameworks are useful to borrow from. Neither is required, and neither is a first step for a 50-person firm.
Written for: Owners, managers, operations and data protection leads in UK organisations of about 10 to 250 people who use AI tools at work but don’t build them.
What is AI governance, in plain terms?
AI governance is the set of decisions, rules and owners that keep an organisation’s use of AI useful, safe and accountable. It answers four questions: what may we use, for what, with which data, and who answers for the result?
Large firms that build AI systems need model testing, risk committees and technical documentation. A firm of 50 that uses a chat assistant, a meeting summariser and the AI built into its accounts package needs something much smaller. Its risks come from how people use tools other companies made: what they paste in, what they send out unchecked, and what the tools are allowed to reach.
So for most small and mid-sized organisations, AI governance is less a programme than a habit: decide, write it down, give it an owner and set a date to look again. Leaving it open is still a decision. With no approved tool and no rule, people use their own accounts, and the policy becomes whatever each person decides. That is how shadow AI starts.
Also called
AI governance framework, responsible AI framework, AI risk management, AI oversight, AI management system.
What does a simple AI governance framework look like?
A workable framework for a small organisation has about ten pieces, each with an owner. Most fit on one page; the rest are short routines. You don’t need them all on day one: the first five, with a review date, cover most of the risk.
The pieces below come from The AI Stairway™, Scorchsoft’s course on AI at work, where each is taught as a short exercise. They are one practical way to organise governance, not an industry standard. The owners are suggestions: in a small firm one person may hold several.
| Piece | What it decides | Suggested owner | Taught in |
|---|---|---|---|
| 1. What happens now | Which tools people already use, and for what. Asked anonymously, without blame. | Whoever leads on AI | Module 7 |
| 2. The trust check | Whether a tool is approved: seven questions, from who runs it to whether your data protection lead would approve this use. | IT or operations, with the data protection lead | Module 6 |
| 3. The tramlines | What data may go into AI, and where: green, amber, red. | Data protection lead | Module 1 |
| 4. The one-page team rule | Approved tools and accounts, the tramlines, owners, how to report a problem, meetings, decisions about people, a review date. | Each team’s manager | Module 6 |
| 5. How to report a problem | One route to ask a question or report a mistake, with no blame for good-faith errors. | Named owner | Module 7 |
| 6. The trust ladder | How far AI may reach into your systems, for each kind of data. | Owner or IT | Module 7 |
| 7. Owners for shared skills | Every shared prompt, skill or agent has an owner, a version and a review date. | The person who shares it | Module 6 |
| 8. The layers of control | Where each rule lives: a prompt asks, a skill shapes, a permission is enforced, code and process checks make sure. | IT, with the process owner | Modules 8 and 9 |
| 9. The 90-day test | Whether a new use is worth scaling: a baseline, cost per finished task and a stop rule decided first. | The sponsor of the idea | Module 10 |
| 10. Review dates | When each rule is looked at again. 90 days for a first version, then at least yearly. | Named owner | Module 6 |
Each piece has one name in the course and in our glossary. Five of the names need a word of explanation:
- The trust check is seven questions to ask of any AI service.
- The tramlines sort information into green (go, with nothing private in it), amber (with care or approval) and red (don’t).
- The trust ladder runs from AI inside one product, to an approved general tool, to connectors that read your systems, to connectors that act.
- The layers of control say where a rule is enforced.
- The 90-day test says whether an idea earns its place.
Where do we start this week?
Start with what people already do, then write one page. A leader can put the first five pieces and a review date in place in a working week without a budget, as long as one person owns the result.
Step 1: Day 1: ask what people use (owner: the person leading on AI)
Send a short anonymous question: which AI tools do you use for work, for what, and on which account? Say plainly that nobody will be disciplined for the answer. Assume some use is on personal accounts.
Step 2: Day 2: pick an approved tool (owner: IT or operations)
Choose one tool on a business account, ideally the one that fits the software you already use, and run the trust check on its business terms. While any of the seven questions is unanswered, treat a tool as unapproved: public information only.
Step 3: Day 3: publish the one-page rule (owner: each team’s manager)
Approved tools and accounts; the tramlines; who owns shared skills; how to report a problem; meetings recorded by AI are announced and the recap is corrected before it goes out; no decision about a person by AI alone; a review date.
Step 4: Day 4: name the owner and the route (owner: the senior person)
One named person answers questions and keeps a short register of approved tools, uses and connectors. One mailbox or channel takes questions and reports.
Step 5: Day 5: brief people and set the review date (owner: the named owner)
A 30-minute session on the rule, the tramlines and checking work in proportion to the stakes. Put the 90-day review in the diary now.
Gareth, the practice manager, asks the team what they use. Eleven people reply; six use AI weekly, four on personal accounts, including Hayley, whose client chasers are the best in the building. Gareth picks the assistant that comes with the practice’s office software on a business account, runs the trust check with the data protection lead, and publishes a page: client names and figures are red outside the approved account; Hayley owns the chaser skill and reviews it each quarter; problems go to one mailbox. The first review is booked for 90 days out.
The one-page team rule: what it covers
- Approved tools and accounts, and how to request a new one
- Green, amber and red information (the tramlines)
- Who owns each shared prompt, skill or agent
- Meetings: tell people when AI records, and correct the recap before sending
- Decisions about people: never by AI alone, and the reviewer can say no
- How to report a problem, without blame
- Who decides, and the review date
Our AI policy template turns this page into a fuller policy, section by section, with sample clauses.
How do we make sure the important rules hold?
Put each rule where it can be enforced. A written instruction asks people or tools to behave; a permission or a process check makes sure. Rules that must never fail belong in settings, permissions or a person’s approval step, not only in a prompt.
The layers of control, taught in Module 8 and used again in Module 9, are a quick test for any rule. A prompt asks. A shared skill shapes the result but is advisory: the tool decides whether to use it. A permission is enforced: a connector set to read only can’t send. Code and checks built into the process make sure: a person approves anything that leaves the organisation, or software checks a limit every time.
- “Never put client data into a personal account.” Enforced by giving people an approved account and switching off what isn’t needed, then backed by the rule.
- “A person checks anything sent to a client.” Enforced by an approval step in the process, not a line in a prompt.
- “The AI may draft replies but not send them.” Enforced by the connector’s permissions.
- “Shared skills stay current.” Enforced by an owner, a version and a review date in the team’s library.
The one thing not to do
Don’t rely on monitoring software or usage targets as your governance. Measuring how much people use AI tells you about usage, not work, and covert monitoring of staff raises its own data protection questions. Give people an approved route first.
What does UK law require of AI governance?
As of 29 October 2026 the UK has no AI Act. AI use is governed by existing law, chiefly data protection, equality and employment law, and by the regulators you already answer to, which apply the government’s AI principles within their own areas.
The government’s approach, set out in its response to the AI regulation white paper (opens in a new tab) (February 2024), is five cross-sector principles for existing regulators to apply within their remits: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. No cross-sector AI law has followed: as of 29 October 2026, Parliament has passed no AI Act.
- Data protection. The UK GDPR and the Data Protection Act 2018 (opens in a new tab) apply whenever personal data goes into an AI tool. The ICO’s guidance on AI and data protection (opens in a new tab) is the place to start, and a data protection impact assessment may be needed for higher-risk uses.
- Decisions about people. The rules on automated decision-making were rewritten by section 80 of the Data (Use and Access) Act 2025 (opens in a new tab), in force since 5 February 2026. Our AI policy template covers what changed.
- Equality. The Equality Act 2010 (opens in a new tab) applies to decisions about staff and customers whether or not AI helped make them.
- Your sector. Regulated firms answer to their own regulator, such as the FCA, the CQC or the SRA, whose rules apply to AI use as they do to anything else.
No general UK law says every business must have an AI policy. Most organisations still benefit from one, and some guidance points that way. The Department of Health and Social Care’s guidance for adult social care (opens in a new tab) (29 September 2026) says that all organisations should consider having an AI policy, “even if your policy is that staff cannot use AI for work purposes”.
What happened to AI Management Essentials?
In November 2024 the Department for Science, Innovation and Technology consulted on AI Management Essentials, a self-assessment tool for AI governance. Its government response (opens in a new tab) (6 February 2026) says the department “will not be publishing AIME”, because one tool for every size of organisation struggled to fit, and that it plans guidance on foundational governance aimed at SMEs instead. In September 2026 the department published an AI Risk Management Toolkit (opens in a new tab) for teams that design, buy or deliver AI products; it is guidance, not a certification scheme.
If you have EU staff, customers or output, the EU AI Act may apply to some of what you do. Its AI literacy duty (Article 4) has applied since 2 February 2025 and was amended in July 2026; our AI literacy guide quotes the current wording and explains when it may reach a UK firm. The Act’s obligations for high-risk uses listed in its Annex III, which include some recruitment and staff-management tools, now apply from 2 December 2027 under the Digital Omnibus on AI (opens in a new tab). If that could be you, take advice.
Should we use ISO/IEC 42001 or the NIST AI framework?
Treat them as frameworks you can borrow from, not requirements. ISO/IEC 42001:2023 is a certifiable management-system standard; the NIST AI Risk Management Framework and its generative AI profile are voluntary. Most small firms take a few ideas from them rather than adopting either whole.
| Framework | What it is | What a small firm might borrow |
|---|---|---|
| ISO/IEC 42001:2023 | An international standard that sets requirements for an AI management system. An organisation can be certified against it by an independent auditor. In the UK it is sold by BSI, the national standards body. | The habit of a written policy, named roles, a register of AI uses, and planned reviews. Certification is worth weighing only if clients ask for it. |
| NIST AI Risk Management Framework (AI RMF 1.0) | A voluntary framework from the US National Institute of Standards and Technology, released in January 2023. Its four functions are Govern, Map, Measure and Manage. NIST says it is being revised. | The four functions as headings for a review: who decides (Govern), where AI is used (Map), how you check it (Measure), what you do about problems (Manage). |
| NIST AI 600-1, the Generative AI Profile | A companion to the AI RMF for generative AI, released in July 2024. Voluntary. | Its list of generative AI risks, such as confabulation (made-up content) and data privacy, as a prompt for your own rule. |
If you map your rule to one of these, call it mapping, not certification. A one-page rule with owners and review dates covers the same ground as the Govern function for a firm of your size; it doesn’t make you certified or meet any standard by itself.
How does governance grow as we use AI more?
Add pieces as AI reaches further. A chat assistant needs the one-page rule; connectors that read your files need the trust ladder and permissions; anything that acts on its own needs layers of control, an owner and a 90-day test before it scales.
The trust ladder from Module 7 is a good trigger for the next piece. Each rung up is more useful and less work for staff, but gives a mistake or an attack more reach. Before you connect AI to email, files or records, decide which rung you accept for each kind of data, who decides, and when you will look again. Our AI maturity model guide shows how these decisions change step by step, and the AI readiness assessment helps you see which pieces are missing.
New uses go through a 90-day test before anyone scales them: a baseline taken first, cost per finished task that counts checking and fixing time, and a stop rule agreed before the test starts. Our 90-day AI pilot guide works one through.
Governance also needs a channel that works. In a study of employee silence, the reason people most often gave for keeping quiet was fear of being seen as a troublemaker or complainer; a quarter said speaking up wouldn’t make a difference (Milliken, Morrison and Hewlin, 2003, 40 interviews in the US). So keep reporting free of blame, and act on what comes through where people can see: try the idea, decline it with a reason, or give it a route to a test.
What doesn’t this framework cover?
It is written for UK organisations that use AI tools made by others. It doesn’t cover building or selling AI systems, high-risk uses under the EU AI Act, or the detailed rules of regulated sectors, and it isn’t legal advice.
If you build AI into products, use AI to make significant decisions about people, process health or other special category data at scale, or sell into the EU, you will need more than this page: likely a data protection impact assessment, sector guidance and legal advice. Following the framework doesn’t by itself make any use of AI lawful; it gives you a clear record of what you decided and why, which is what a qualified reviewer will want to see.
Questions people ask
Do UK businesses have to have an AI policy?
No general UK law requires one, as of 29 October 2026. Most organisations still benefit from a short policy, because without one people decide for themselves. Some sector guidance encourages it: the Department of Health and Social Care tells adult social care providers that all organisations should consider having one.
Who should own AI governance in a small company?
One named senior person who answers questions, keeps a short register of approved tools and uses, and calls the reviews. Data decisions sit with the data protection lead, technical settings with IT, and each team’s rule with its manager.
What is the difference between an AI policy and AI governance?
The policy is the written document. Governance is the whole system around it: who decides, how tools are approved, where rules are enforced, how problems are reported, and when everything is reviewed.
Is ISO/IEC 42001 certification worth it for a small business?
Usually not as a first step. It suits organisations whose clients ask for evidence of an AI management system, or that build AI. Most small firms get more from a one-page rule with owners and review dates, and can borrow the standard’s structure later.
How often should we review our AI rules?
Review a first version within 90 days, because tools and uses change quickly, then at least once a year, and whenever you add a new kind of tool, connect AI to new systems or the law changes.
Training for the whole team
The AI Stairway™ gives everyone the same careful habits, then helps your team agree its rules and test one AI idea properly. Everyone can start with the free introductory module.
AI training for teamsSources
Every figure on this page comes from one of these. Links open in a new tab.
- A pro-innovation approach to AI regulation: government response (opens in a new tab). Department for Science, Innovation and Technology, GOV.UK, 6 February 2024.
- AI Management Essentials tool: government response (opens in a new tab). Department for Science, Innovation and Technology, GOV.UK, 6 February 2026.
- Using AI in adult social care (opens in a new tab). Department of Health and Social Care, GOV.UK, 29 September 2026.
- Data (Use and Access) Act 2025, section 80 (automated decision-making) (opens in a new tab). legislation.gov.uk, in force 5 February 2026; read 29 October 2026.
- Guidance on AI and data protection (opens in a new tab). Information Commissioner’s Office, read 29 October 2026.
- BS ISO/IEC 42001:2023 Information technology. Artificial intelligence. Management system (BSI now sells it as BS EN ISO/IEC 42001:2026, the European adoption, with no technical change) (opens in a new tab). BSI, December 2023; read 29 October 2026.
- AI Risk Management Framework (AI RMF 1.0) (opens in a new tab). National Institute of Standards and Technology (US), January 2023; page read 29 October 2026.
- NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (opens in a new tab). National Institute of Standards and Technology (US), July 2024.
- AI Risk Management Toolkit (opens in a new tab). Department for Science, Innovation and Technology, GOV.UK, 8 September 2026.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) (opens in a new tab). Official Journal of the European Union (EUR-Lex), 24 July 2026.
- An exploratory study of employee silence: issues that employees don’t communicate upward and why (opens in a new tab). Milliken, Morrison and Hewlin, Journal of Management Studies 40(6), 2003.
Keep going
Related guides
- AI policy template: what to include and how to write yours
- What is AI literacy? What it looks like at work, and what EU Article 4 asks
- AI readiness assessment: a 12-question self-check for your organisation
- AI maturity models: what they are, and how to use one honestly
- Shadow AI: why staff use unapproved AI tools, and what to do about it